Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
13/04/2022, 09:32
General
- Target IconCacheService.dll
- Size 248KB
- Sample220413-lhmfcsahbk
- SHA256 95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f
Malware Config
Signatures
- Blocklisted process makes network request 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 25 IoCs
- Suspicious use of SendNotifyMessage 24 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\IconCacheService.dll,#11⤵
- Blocklisted process makes network request
- Adds Run key to start application
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\Desktop'1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe"2⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" .\IconCacheService.dll IconCacheDBService2⤵
- Blocklisted process makes network request
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" .\IconCacheService.dll,IconCacheDBService2⤵
- Blocklisted process makes network request
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
50CD3D75D026C82E2E718570BD6F44D0_11AE042D5C35868B5237021024D2A4C4
B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
50CD3D75D026C82E2E718570BD6F44D0_11AE042D5C35868B5237021024D2A4C4
B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
memory/444-144-0x00007FFDFA1B0000-0x00007FFDFA3A5000-memory.dmp
memory/444-143-0x00007FFDFA1B0000-0x00007FFDFA3A5000-memory.dmp
memory/2176-125-0x00007FFDFA1B0000-0x00007FFDFA3A5000-memory.dmp
memory/2176-124-0x00007FFDFA1B0000-0x00007FFDFA3A5000-memory.dmp
memory/3744-129-0x0000020ABE950000-0x0000020ABE952000-memory.dmp
memory/3744-134-0x0000020AD9040000-0x0000020AD905E000-memory.dmp
memory/3744-132-0x0000020AD9160000-0x0000020AD91D6000-memory.dmp
memory/3744-131-0x0000020ABE956000-0x0000020ABE958000-memory.dmp
memory/3744-130-0x0000020ABE953000-0x0000020ABE955000-memory.dmp
memory/3744-128-0x00007FFDD9AB0000-0x00007FFDDA571000-memory.dmp
memory/3744-127-0x0000020AD9090000-0x0000020AD90D4000-memory.dmp
memory/3744-126-0x0000020ABE840000-0x0000020ABE862000-memory.dmp
memory/5068-136-0x00007FFDFA1B0000-0x00007FFDFA3A5000-memory.dmp
memory/5068-141-0x00007FFDFA1B0000-0x00007FFDFA3A5000-memory.dmp